Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fb0sh/pentester/crypto-toolkitnpx skills add fb0sh/pentester --skill crypto-toolkitgit clone --depth 1 https://github.com/fb0sh/pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00069 | $0.01755 |
| Opus 5 | $0.00034 | $0.00877 |
| Sonnet 5 | $0.00014 | $0.00351 |
| Haiku 4.5 | $0.00007 | $0.00176 |
Grade A, and why
crypto-toolkit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to crypto-toolkit — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
编码解码与加解密 Skill
针对渗透测试中常见的编码、加密、混淆场景，提供全面的编解码和加解密能力。
重要：遇到任何编码/加密字符串时，优先使用 crypto_decode 工具进行解码，而非靠直觉猜测。
核心原则
- 工具优先 — 遇到 base64、hex、URL编码等字符串，调用
crypto_decode工具解码，不要自行脑补 - 多格式尝试 — 如果一种解码方式结果不合理，尝试其他编码格式
- 链式解码 — CTF 中常见多层编码（如 base64→hex→ROT13），解码后检查结果是否还需再次解码
- 验证结果 — 解码后验证结果的合理性（是否为可读文本、是否像路径/URL/flag 等）
1. 编码识别与解码
常见编码特征识别
| 编码类型 | 特征 | 示例 |
|---|---|---|
| Base64 | A-Za-z0-9+/= 结尾常有 = 填充 |
TnNTY1RmLnBocA== |
| Base32 | A-Z2-7= |
OBZHK5DFN2A==== |
| Hex | 0-9a-f 偶数长度 |
4e73536354662e706870 |
| URL编码 | %XX 格式 |
%2F%61%64%6D%69%6E |
| HTML实体 | &#xNN; 或 &#NNN; |
<script> |
| Unicode转义 | \uXXXX 或 \UXXXXXXXX |
\u003c\u0073\u0063 |
| JWT | 三段 . 分隔的 base64 |
eyJhbG... |
解码策略
- 识别编码类型 → 调用
crypto_decode工具指定对应操作 - 检查解码结果是否可读/合理
- 不合理则尝试其他编码格式
- 如果结果仍像编码，重复步骤 1-3
2. 哈希与散列
常见哈希类型
| 类型 | 输出长度 | 特征 |
|---|---|---|
| MD5 | 32 hex | e10adc3949ba59abbe56e057f20f883e |
| SHA1 | 40 hex | aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d |
| SHA256 | 64 hex | 2c26b46b68ffc68ff99b453c1d30413413422d7064... |
| SHA512 | 128 hex | 更长的hex字符串 |
| NTLM | 32 hex | Windows hash |
| MySQL5 | 41字符 | *E6CC90B878B948C35E92B003C792C46758BF4 |
哈希处理策略
- 识别哈希类型（通过长度和字符集）
- 尝试在线彩虹表查询（通过 fetch 工具访问 crackstation 等）
- 对于已知盐值的哈希，尝试带盐值暴力破解
3. 对称加密
AES/DES/3DES
- 需要密钥和模式（ECB/CBC/CTR 等）
- CBC 模式需要 IV
- 常见填充：PKCS7/ZeroPadding
- 渗透中常遇到硬编码密钥，优先从源码中提取
4. 非对称加密
RSA
- 从公钥/私钥文件中提取参数
- 模数过小的 RSA 可分解
- 已知私钥可直接解密
5. 古典密码
| 类型 | 特征 | 破解方法 |
|---|---|---|
| Caesar/ROT13 | 字母位移 | 暴力25种位移 |
| Vigenere | 多表替换 | Kasiski/频率分析 |
| 栅栏密码 | 字符分组重组 | 尝试常见栏数 |
| 培根密码 | AB 五元组 | 查表 |
| Morse | .- 点划 |
查表 |
6. JWT 处理
- 解码 Header + Payload（base64url）
- 检查算法：
none算法绕过、RS256→HS256 算法混淆 - 尝试弱密钥签名伪造
- 检查 exp/nbf 等时间声明
工具使用
crypto_decode 工具
当遇到需要编码/解码/加密/解密的操作时，调用此工具：
crypto_decode(operation="base64_decode", input="TnNTY1RmLnBocA==")
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 131 lines · 69 tokens per session scan A 3715ff7e0c46
crypto-toolkit is a skill published in the GitHub repository fb0sh/pentester (23 stars, last pushed 1mo ago), licensed MIT. It adds 69 tokens to every session and 1,755 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to crypto-toolkit, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
transilience-report-style
Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards.
firewall-review
Evidence-safe firewall ruleset audit reference specification — 22 documented detector patterns (17 vendor-agnostic plus 5 FortiGate-specific), a 15-check semantic catalogue, CIS Fortinet FortiGate Benchmark guidance, a custom customer-policy benchmark, and consolidated network-team Excel profiles including grouped…
pentest-engagement
Run a professional penetration engagement OR a network vulnerability scan from a scope. WEB mode (apex domains / app URLs) — mandatory surface expansion, systematic OWASP attack-class coverage, reversible active exploitation, authoritative validation, Transilience PDF. NETWORK mode (a list of IPs/CIDRs, e.g. 1500…
attack-path-stitcher
Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.
coordination
Pentest coordination — orchestrates executor and validator agents with context-controlled spawning. Entry point for all engagements.
hackerone
HackerOne bug bounty automation - parses scope CSVs, deploys parallel pentesting agents per asset, validates PoCs, and generates platform-ready submission reports.